AsyncSSH, a Python package implementing SSHv2 asynchronously, improperly limits pathname access when expanding the OpenSSH-compatible AuthorizedKeysFile %u token. Before version 2.23.0, the expansion uses the raw SSH username during pre-authentication server config reload, which can include path traversal segments such as '/', '\', or '..'. This allows an attacker to cause the server to read authorized keys files outside the intended directory, enabling authentication using an attacker-controlled key file. The vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

An attacker can exploit this vulnerability by crafting an SSH username containing path traversal sequences to bypass directory restrictions on authorized keys files. This can lead to unauthorized authentication with attacker-selected keys, potentially allowing unauthorized access to the SSH server. The CVSS 4.0 score is 8.2 (high severity), indicating a significant risk if exploited.

This vulnerability is fixed in AsyncSSH version 2.23.0. Users should upgrade to version 2.23.0 or later to remediate the issue. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 2.23.0. No other mitigation or temporary fix is indicated.